{"record":{"id":"068a2400c840b348","repo":"ory/hydra","slug":"no-tls-configuration-was-found","errorCode":null,"errorMessage":"no tls configuration was found","messagePattern":"no tls configuration was found","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/tlsx/cert.go","lineNumber":36,"sourceCode":"\t\"encoding/pem\"\n\t\"fmt\"\n\t\"io\"\n\t\"math/big\"\n\t\"os\"\n\t\"path/filepath\"\n\t\"slices\"\n\t\"sync/atomic\"\n\t\"testing\"\n\t\"time\"\n\n\t\"github.com/pkg/errors\"\n\t\"github.com/stretchr/testify/require\"\n\n\t\"github.com/ory/x/watcherx\"\n)\n\n// ErrNoCertificatesConfigured is returned when no TLS configuration was found.\nvar ErrNoCertificatesConfigured = errors.New(\"no tls configuration was found\")\n\n// ErrInvalidCertificateConfiguration is returned when an invalid TLS configuration was found.\nvar ErrInvalidCertificateConfiguration = errors.New(\"tls configuration is invalid\")\n\n// HTTPSCertificate returns loads a HTTP over TLS Certificate by looking at environment variables.\nfunc HTTPSCertificate() ([]tls.Certificate, error) {\n\tprefix := \"HTTPS_TLS\"\n\treturn Certificate(\n\t\tos.Getenv(prefix+\"_CERT\"), os.Getenv(prefix+\"_KEY\"),\n\t\tos.Getenv(prefix+\"_CERT_PATH\"), os.Getenv(prefix+\"_KEY_PATH\"),\n\t)\n}\n\n// HTTPSCertificateHelpMessage returns a help message for configuring HTTP over TLS Certificates.\nfunc HTTPSCertificateHelpMessage() string {\n\treturn CertificateHelpMessage(\"HTTPS_TLS\")\n}\n","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/tlsx/cert.go#L18-L54","documentation":"ErrNoCertificatesConfigured is returned when no TLS certificate material was provided at all — the code path checks that cert/key PEM base64 values and cert/key file paths are all empty. It signals that HTTPS cannot be configured because there is nothing to load, and is wrapped with a stack trace by the tlsx helpers.","triggerScenarios":"Calling Certificate() (or GetCertificate) with all of certPEMBase64, keyPEMBase64, certPath, keyPath empty; calling HTTPSCertificate()/other env-based helpers with no HTTPS_TLS_CERT/HTTPS_TLS_KEY environment variables set; calling LoadCertificate with only one of certPath/keyPath empty (cert.go:145).","commonSituations":"Forgetting to mount or set TLS secret/env variables in Kubernetes or Docker deployments; running locally without TLS intending plain HTTP but code still requests a certificate; only supplying the certificate without its private key (or vice versa) in the path-based variant.","solutions":["Provide both the certificate and key — either as base64 PEM values or as file paths","Set the expected environment variables (e.g. HTTPS_TLS_CERT and HTTPS_TLS_KEY) for the env-based helper","If TLS is intentionally disabled, guard the certificate-loading call instead of invoking it unconditionally","For file-based loading, ensure BOTH cert and key paths are non-empty before calling"],"exampleFix":"// before\n// no TLS env vars set\ncerts, err := HTTPSCertificate() // ErrNoCertificatesConfigured\n// after\nexport HTTPS_TLS_CERT=$(base64 -w0 server.crt)\nexport HTTPS_TLS_KEY=$(base64 -w0 server.key)\ncerts, err := HTTPSCertificate()","handlingStrategy":"validation","validationCode":"func tlsConfigured(certPEM, keyPEM, certPath, keyPath string) bool {\n\treturn (certPEM != \"\" && keyPEM != \"\") || (certPath != \"\" && keyPath != \"\")\n}","typeGuard":"func isNoCertsConfigured(err error) bool {\n\treturn errors.Is(err, tlsx.ErrNoCertificatesConfigured)\n}","tryCatchPattern":"certs, err := tlsx.HTTPSCertificate()\nif err != nil {\n\tif errors.Is(err, tlsx.ErrNoCertificatesConfigured) {\n\t\tlog.Println(\"TLS disabled: no certificates configured\")\n\t\treturn servePlainHTTP()\n\t}\n\treturn err\n}","preventionTips":["Always provide cert AND key together (PEM base64 or file paths)","Check that required TLS env vars/mounted secrets exist before starting the server","Decide explicitly: either configure TLS or deliberately serve plain HTTP with a guard"],"tags":["go","tls","configuration","certificates"],"backgroundTag":"missing-tls-certificate","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}